My form submission get blocked because the frame is sandboxed and the 'allow-forms' permission is not set

Question

I'm trying to build a custom form and submission post for Hubspot.

I have the following code

HTML

<head>
<script src="prezzi-form-submit.js"></script>
</head>
<body>

  <form class='form-inline' id='my-custom-form'>
    <div class="form-group">
      <input type='email' class='form-control' placeholder='Your email address' required>
    </div>
    <button class="btn btn-primary" type='submit'>Sign up</button>
  </form>

  <!-- Actual form that gets submitted to HubSpot -->
  <div class="hidden" id='hubspot-form'>
    <script charset="utf-8" src="//js.hsforms.net/forms/current.js"></script>
    <script>
      hbspt.forms.create({
        portalId: 'my-portal-id',
        formId: '92b9b82a-0da2-4e23-8a30-04541c05ce6d',
        onFormReady: function($form) {
          $form.attr('target', 'hubspot-iframe');
        }
      });
    </script>

    <!-- iFrame that data will get submitted to. This hack stops the page redirect. -->
    <iframe name="hubspot-iframe" id="hubspot-iframe" sandbox="allow-forms"></iframe>
  </div>
</body>

JS (prezzi-form-submit.js)

// // Send form data to HubSpot from the client.
function submitToHubSpot(data) {
  var $form = $('#hubspot-form form'),
      k;

  // Loop through each value and find a matching input.
  // NOTE: Doesn't support checkbox/radio.
  for (k in data) {
    $form.find("input[name='" + k + "']").val(data[k]);
  }

  $("form input:submit").trigger("click");
}

// Here's how you'd use this.
$('#my-custom-form').on('submit', function() {
  var formData = {};
  $(this).serializeArray().forEach(function(data) {
    formData[data.name] = data.value;
  });

  submitToHubSpot(formData);

  // We sent the data. Now do whatever else you want.
  alert('Gee, thanks Jonathan! Now I can focus on onboarding my customers with Appcues!');
  window.location.href = 'http://appcues.com';
})

When I press the submit button, I get the following error in the console

Blocked form submission to " " because the form's frame is sandboxed and the 'allow-forms' permission is not set.

As you can see I have the

sandbox="allow-forms"

set in the I frame but it isn't working. How can I fix this error?

There are not enough elements to give a certain solution but it seems to me there is a bad response from the server. Probably Javascript is making a preflight call in HTTP OPTIONS method to see if it can really call the form action but the server is responding a Access-Control-Allow-Origin header that doesn't let the form submit. I'd suggest you check the network tab in your browser and have a look at the requests being sent to the server and relative responses. — 500 Server error
I have been seeing similar behavior (not in Hubspot but in other applications we are running locally). I'm not sure if this is a change to browsers as it happened without and source code changes. The weird thing is it is happening on Chrome, Edge & Firefox. — Will Young

Benoit Duffez Benoit Duffez · Accepted Answer · 2019-07-16T21:54:39

Sometimes when you click a link from an application, the tab opened will have javascript disabled/sandboxed.

Close the tab and reopen the same URL in a fresh tab, it might work.

My form submission get blocked because the frame is sandboxed and the 'allow-forms' permission is not set

3 Answers